In today's world, on equipment that is properly updated to the latest software/firmware, is UPnP still insecure, or have its vulnerabilities been fixed?
Why is/was UPnP insecure anyway?
UPnP's bad name comes from implementation issues found in 2011-2013. It's like saying email is insecure and should be disabled because someone found a common issue in multiple email clients some years ago.
I always disabled UPnP because everyone said so. Now that I looked into it, it turns out to be silly. When UPnP was new, some devices were found to allow configuration from the Internet. Anyone could open any port on it. Since then, router vendors had plenty of time to fix their software. Security is a much bigger thing now than it was in 2011 (that's about the time when the first iPad was released), so vendors are more aware of security issues. For older routers, if they were vulnerable in the first place, a firmware update has probably been released long ago.
What is the purpose of UPnP?
UPnP is a solution to an issue that is created by having too few IP addresses. Because not everyone can have their own, we need to share them. The way we do this is by Network Address Translation (NAT): your consumer router translates between your local network (for example 192.168.x.x) and your public IP address (for example 2184.108.40.206). Peer to peer applications such as file sharing, calling or video calling, distributing updates (Windows, Google Play), anonymity networks, resilient mesh networks, etc. all cannot function through NAT, so we have to either disable it for specific applications (using port forwarding), or find workarounds (such as UDP/TCP hole punching, STUN, etc.). The UPnP protocol is what an application uses to tell the router that it would like to disable NAT for an application. It's basically automatic port forwarding.
Not enabling UPnP means we need workarounds instead of being able to have peer to peer communication. Software developers that hope to make a profit off of you will spend money on running servers to keep those workarounds functional for you, but free software often does not have such luxuries and cannot function without either UPnP, or you forwarding the port manually.
Then why are the others saying "Yes, it's insecure by design"?
(Spoiler: they are wrong.)
Because NAT is ubiquitous in IPv4, many people started to rely on it for security: because you cannot reach individual hosts inside the network, vulnerabilities cannot be exploited from the outside, and people started turning off security measures inside their LAN. They neglected doing security updates and opened file shares without passwords (because nobody ever takes their laptop outside their LAN, right?), so now you need a firewall that is outside of your laptop, for example in your router. Combine this with the idea that UPnP can open ports, and you get misinformed answers such as the previously top-voted answer.
Ask yourself: what makes that UPnP request to your router to open a port? It has to be something inside your network. For example, malware could tell the router to open it. How terrible! But wait, if you have malware running on your network, and your laptop is not secure... then you are already screwed right? Yes, indeed.
Malware does not need UPnP to reach your local devices: for it to be able to do UPnP, it already needs to be on your device, or inside your network, so it can reach the internal devices by itself without using UPnP.
Or what if a friend brings their smartphone that is infected with malware? It could tell the router to do UPnP to your other devices and expose them. True enough, but again: the malware is already inside your network and can already reach your local devices directly.
UPnP is fine to enable if your router is not ancient, or if you installed firmware updates for it (or if it was never vulnerable in the first place).
Yes, UPnP is by design insecure.
UPnP is a protocol designed to automatically open ports in a firewall to allow an outsider to access a hosted server on a local machine that is protected by said firewall.
UPnP is like mounting a lock on a door and then leaving the key in the keyhole. What's the point of mounting a lock then?
It goes without explanation to say why this is a bad protocol from the beginning, to aid "newbies" who can't even go to 192.168.0.1/192.168.1.1 and forward a simple port if that's required.
UPnP effectively makes the firewall useless. Any trojan could then set up a listening IRC server, RAT server or anything other suspicious and then ask the firewall to open the port for them.
If you have a router which supports UPnP, disable the protocol immediately. I haven't yet stumbled upon a router which does not permit disabling UPnP, so in all routers it should be possible. It might be some ISP locked down router that has customer administration completely disabled, but then you should be able to ask your ISPs customer service to have UPnP disabled.
I think I should expand a bit and clarify what sebastian nielsen said.
UPnP is as secure as the operating systems of the devices behind the firewall or router NAT/PAT.
If you have a linux, BSD, or unix box behind the router and you have a standard user setup where you do not use root to do any user activities then your chances of running afoul of a trojon capable of using UPnP to compromise your network is low.
If you are running windows or have an android device where you download apps that are not vetted by the Play store then you are very vulnerable.
Most routers have options for directing external ports to internal ports so you can setup a port or a range of ports to talk to the machine where you need a port opened. For security sake it is wise to not open a redirected port in the 0-1024 range as these are common ports that will be a likely target for scanning by hackers.
UPnP just opens connectivity from a device within your network to another outside it, on the device request. So basically the security of that just comes down to if that request was made by a well intended software or a malware.
UPnP isn't the weak point, but the security of the apps installed on the device. Firewalls, manual port forwarding, antivirus and app stores are just workarounds for that, but not the real solution.
The real solution is using software which source code is available to inspect, installed from a software center, and frequently patched for security vulnerabilities. Namely Linux.
Rather than definitively say that uPNP is secure by design, or insecure by design, it makes more sense to specify what it actually facilitates - what hosts on the local network can do with uPNP that they couldn't otherwise.
In a NAT situation, any host on the inside is already able to "open up a port", simply by sending a packet out on that port. But, that port mapping is only valid for the remote host address it was addressed to - it doesn't open that port up to "the world" like uPNP does.
So, a local host is able to facilitate both outgoing and incoming communication to any remote host they choose - but they must choose. A local host is not able to open itself up to communication from all hosts.
Now, that is a desirable thing to want to do if you are running a service that should be publicly available to the world. Examples include if you're running a server like a web, FTP or mail server. But this is also the case with certain peer to peer activity. For example in bittorrent, you want anybody to be able to contact you and download a piece of a file you are hosting, even if you don't think of yourself as providing a service.
In a business environment, you would specifically set up rules for those services you want to host.
In a home environment, however, "hosting" things is often thought of in more of an ad-hoc manner, and home users don't want to have to configure their router for everything they use which requires a port open to the world. This is where uPNP fits.
Yes, it does open up new abilities for local hosts that would not be allowed otherwise, which includes the ability to accept incoming connections to a port from anyone.
This can be thought of as adding, or at least widening, a vector for possible vulnerabilities. Malware running on a local host is already able to do a lot without uPNP; uPNP just gives it a small additional ability.
It is a trade-off between ease of use and control over network communication; and to many it will be a completely fair trade-off, and to others not.
The argument that NAT is merely a side-effect of IPv4 depletion rather than a security feature is a little off-target IMO. If it weren't for NAT, it would still be a good idea to have a firewall at the boundary of your local network that denies incoming traffic that wasn't initiated from inside the firewall, except in specific cases that you have set up. And, IPv6 enabled devices often offer such a feature even when there's no need for NAT. You can say that each host should have its own such firewall instead and treat other hosts as equally untrusted, but there exists a lot of IP connected (IoT) devices which aren't configurable in that way. Sure, judicious outgoing blocking like port 25 is also useful.